Remote wireless sniffer management

ABSTRACT

An example method may include receiving, from a wireless sniffer, sniffer data for a window of time, where the sniffer data may include wireless signal data. The method may also include obtaining corresponding access point data from an access point in a wireless network for at least part of the window of time for which the sniffer data is received. The method may additionally include analyzing the sniffer data and the corresponding access point data to assess performance of the wireless network.

CROSS-REFERENCE TO RELATED APPLICATIONS

This patent application claims the benefit of prior filed U.S.Provisional Application No. 62/817,385 filed on Mar. 12, 2019 and priorfiled U.S. Provisional Application No. 62/821,945 filed on Mar. 21,2019. The 62/817,385 application and the 62/821,945 application are eachincorporated herein by reference in their entireties.

FIELD

The implementations discussed herein are related to dynamic selection ofreceive parameters.

BACKGROUND

Unless otherwise indicated herein, the materials described herein arenot prior art to the claims in the present application and are notadmitted to be prior art by inclusion in this section.

Home, office, stadium, and outdoor networks, a.k.a. wireless local areanetworks (WLAN) are established using a device called a Wireless AccessPoint (WAP). The WAP may include a router. The WAP wirelessly couplesall the devices of the local network, e.g. wireless stations such as:computers, printers, televisions, digital video (DVD) players, securitycameras and smoke detectors to one another and to the Cable orSubscriber Line through which Internet, video, and television isdelivered to the local network. Most WAPs implement the IEEE 802.11standard which is a contention-based standard for handlingcommunications among multiple competing devices for a shared wirelesscommunication medium on a selected one of a plurality of communicationchannels. The frequency range of each communication channel is specifiedin the corresponding one of the IEEE 802.11 protocols being implemented,e.g. “a”, “b”, “g”, “n”, “ac”, “ad”, “ax”. Communications follow a huband spoke model with a WAP at the hub and the spokes corresponding tothe wireless links to each ‘client’ device or station (STA) utilizingthe WLAN.

However, certain circumstances can cause problems with receiving orutilizing a WLAN by a STA, such as lack of signal strength,interference, etc. It can be difficult to identify and/or solve suchproblems.

The subject matter claimed herein is not limited to implementations thatsolve any disadvantages or that operate only in environments such asthose described above. Rather, this background is only provided toillustrate one example technology area where some implementationsdescribed herein may be practiced.

SUMMARY

This Summary is provided to introduce a selection of concepts in asimplified form that are further described below in the DetailedDescription. This Summary is not intended to identify key features oressential characteristics of the claimed subject matter, nor is itintended to be used as an aid in determining the scope of the claimedsubject matter.

Some example implementations described herein generally relate tomanagement of a remote wireless sniffer. Some implementations provide amethod and/or apparatus to manage a remote wireless sniffer.

An example method may include receiving, from a wireless sniffer,sniffer data for a window of time, where the sniffer data may includewireless signal data. The method may also include obtainingcorresponding access point data from an access point in a wirelessnetwork for at least part of the window of time for which the snifferdata is received. The method may additionally include analyzing thesniffer data and the corresponding access point data to assessperformance of the wireless network.

The invention may be implemented in hardware, firmware, or software.

Associated devices and circuits are also claimed.

Additional features and advantages of the invention will be set forth inthe description which follows, and in part will be obvious from thedescription, or may be learned by the practice of the invention. Thefeatures and advantages of the invention may be realized and obtained bymeans of the instruments and combinations particularly pointed out inthe appended claims. These and other features of the present inventionwill become more fully apparent from the following description andappended claims or may be learned by the practice of the invention asset forth hereinafter.

BRIEF DESCRIPTION OF THE DRAWINGS

To further clarify the above and other advantages and features of thepresent invention, a more particular description of the invention willbe rendered by reference to specific implementations thereof which areillustrated in the appended drawings. It is appreciated that thesedrawings depict only typical implementations of the invention and aretherefore not to be considered limiting of its scope. The invention willbe described and explained with additional specificity and detail usingthe accompanying drawings in which:

FIG. 1 illustrates an example operating environment that may implementremote management of a wireless sniffer;

FIG. 2 illustrates another example operating environment that mayimplement remote management of a wireless sniffer;

FIG. 3 is a block diagram of an example wireless sniffer;

FIG. 4 is an example visualization of time correlated data;

FIG. 5 is a flowchart of an example method of remote management of awireless sniffer; and

FIG. 6 illustrates an example computing device,

all arranged in accordance with at least one implementation describedherein.

DETAILED DESCRIPTION OF SOME EXAMPLE IMPLEMENTATIONS

Implementations described herein may generally include an approach tofacilitate remote management of a wireless sniffer. For example, the useof a remote wireless sniffer may facilitate troubleshooting or othererror correction without sending a technician or other individual to apremise.

Usage of Wi-Fi in internet connected devices is growing exponentially.If home, work or hotspot internet is available, the last hop for devicesto access the internet is Wi-Fi. The Wi-Fi protocol (like all digitalwireless systems) is very complex at the Physical (PHY), Medium AccessControl (MAC) layers. With the proliferation of both number, types andusage of Wi-Fi devices; connectivity problems can and do occurfrequently. These problems have diverse sources. For example, a clientdevice (STA) may not work properly with a given Access Point (AP), orthe medium may be very congested leading to poor and/or erraticperformance. While APs and STA are required to go through Wi-Fi alliancecertification to ensure interoperability, the combination of AP and STAmodels makes exhaustive testing of all combinations impossible.

The use of a wireless sniffer to obtain sniffer traces is a tool forsystem debugging in Wi-Fi networks. Wireless sniffers may operate inpromiscuous mode capturing all packets in a channel and/or frequency towhich the wireless sniffer is tuned. Information associated with bothcontrol and data plane issues or errors may be deduced from sniffertraces. For example, in the control plane, failed authenticationattempts may be deduced; and in the data plane, excessive retry ofpackets may be deduced. However, the actual cause of the issues orerrors may not be properly discerned from only such sniffer data. Forexample, in the case of excessive retries, the reason for the issue orerror may be failure of the AP to receive the acknowledge (ACK) packets.The indication that some or most ACKs are not received is only presentin data obtainable from the AP, and not in a sniffer trace.

On the other hand, data obtained from an AP is not sufficient by itselffor some situations, such as when there is a hidden node (some devicewhose packets may interfere with communication between an AP and an STA,but which is not visible to the AP so that contention based mediumaccess does not work well). In such a circumstance, the STA may not bereceiving the packets transmitted by the AP due to interference notvisible to the AP, leading to AP not seeing ACKs. This interference willbe visible to a wireless sniffer that is in proximity to the STA. Thus,the cause of non-reception of ACKs may be due to a firmware tuning issueon the AP, a hidden node not observable by the AP, or other reasons.Without information from both the Wireless sniffer and the AP, it may bedifficult to determine what may be the actual cause of the underlyingissue or error.

As described in the present disclosure, by having information fromwireless sniffers and AP, and correlating the two data sets together,may provide greater insight into determining a cause of an error andproviding a potential solution. The data collection, analysis, and errorresolution may be performed by a cloud computing system. While such datacorrelation and data analysis may be performed by a human operator, suchan approach may be highly inefficient as the issue or error my come andgo, or the operator may miss something, or simply arrive too late toobserve the issue.

Reference will now be made to the drawings to describe various aspectsof example implementations of the invention. It is to be understood thatthe drawings are diagrammatic and schematic representations of suchexample implementations, and are not limiting of the present invention,nor are they necessarily drawn to scale.

FIG. 1 illustrates an example operating environment 100 that mayimplement remote management of a wireless sniffer 130, in accordancewith one or more embodiments of the present disclosure. The environment100 includes one or more access points (APs) 110, stations (STAs) 120,wireless sniffers 130, and a cloud system 140. The solid arrows betweenthe cloud system 140 and various components of the environment 100illustrate a communication link between the cloud system 140 and therespective component, and the dashed arrows between the APs 110 and theSTAs 120 illustrate a wireless connection, such as over a Wi-Fi network.

The APs 110 (such as the APs 110 a or 110 b) may include a gateway, arepeater, a mesh node, and/or other suitable access point for wirelessstations or devices such as the STAs 120. The APs 110 may connect to theInternet and/or a core network via a bridge, a backhaul link, a basestation, and/or other suitable devices or connections. One exampleimplementation of the APs 110 as a computing device is illustrated inFIG. 6.

Each of the STAs 120 may generally include any device that has thecapability to wirelessly connect to the AP 106 according to any of the802.11 standards or other suitable wireless standard. Each of the STAs102, 104 may include a desktop computer, a laptop computer, a tabletcomputer, a mobile phone, a smartphone, a personal digital assistant(PDA), a smart television, or any other suitable wireless station. Oneexample implementation of the APs 110 as a computing device isillustrated in FIG. 6.

The wireless sniffer 130 (such as the wireless sniffers 130 a, 130 b,and/or 130 c) may include any device with an ability to “listen” towireless signals or other network signals. For example, the wirelesssniffer 130 may include one or more wireless network chips or cards thatare set to a promiscuous mode such that all traffic that is received maybe passed to a processor of the sniffer 130. In these and otherembodiments, the wireless sniffer 130 may store the traffic that isobserved in the environment 100. In some embodiments, the wirelesssniffer 130 may operate with a rolling buffer that may store a previousset time and as that time expires, over-write or discard the old data.For example, if the rolling buffer covered two minutes, the precedingtwo minutes of data observed by the wireless sniffer 130 in theenvironment 100 may be stored and as the stored data is older than twominutes, that data may be discarded or written over with new data. Insome embodiments, the wireless sniffer 130 may store such data inwindows of time (e.g., a two-minute window of data as a single file) andmay archive or otherwise store the window of time of data and being anew window of time. In some embodiments, the wireless sniffer 130 may beconfigured to hop between channels and/or frequencies. For example, if apremise includes APs 110 operating at two different channels in the 2.4GHz band, the wireless sniffer 130 may hop between the two channelsperiodically. In some embodiments, the wireless sniffer 130 may includea repurposed or specially programmed laptop computer, mobile telephone,or other device with a wireless network chip or card. In someembodiments, the wireless sniffer 130 may be configured to continuouslymonitor or otherwise detect wireless signals.

In some embodiments, the wireless sniffer 130 may include one or morespecialized or customizable features. For example, the wireless sniffer130 may be a device that only “listens” to wireless signals and storessuch data in a storage device accessible by a secondary computer. Asanother example, the wireless sniffer 130 may be programmable to shiftbetween certain frequencies or channels at certain timer intervals orbased on certain conditions. As a further example, the wireless sniffer130 may be programmable to discard certain data or otherwise filter theobtained data. As an additional example, the wireless sniffer 130 may beprogrammable to transmit data.

In some embodiments, the wireless sniffer 130 may be configured tomonitor for announcements within the wireless network accessible via theAPs 110. For example, the wireless sniffer 130 may be configured toautomatically pass along any announcement of a device joining thewireless network (e.g., when the STA 120 b joins the wireless network),when a device drops from the wireless network, etc. For example, thewireless sniffer 130 may be configured to transmit such an announcementto the cloud system 140, regardless of whether or not the wirelesssniffer 130 has received a trigger or other message requesting that thewireless sniffer 130 transmit data to the cloud system 140. Additionallyor alternatively, the sniffer 130 may pass along any associationattempts (e.g., attempts at joining the wireless network). In these andother embodiments, the same or similar information may also be obtainedby the APs 110. For example, the APs may pass along announcementinformation of STAs 120 joining the wireless network.

In some embodiments, by using multiple sniffers 130, a resolution ofsignal strength as a device roams around the wireless network may beobserved. For example, the use of the sniffers 130 a, 130 b, and 130 cmay permit a determination of relative signal strength of the station120 b as the STA 120 b roams around a location covered by the APs 110 aand 110 b. In these and other embodiments, the cloud system 140 mayutilize the data from the wireless sniffers 130 to provide a resolutionof how far the STA 120 b may roam before losing connectivity.Additionally or alternatively, such information from the wirelesssniffers 130 may be used to predict the location, speed of movement,etc. for the STA 120 b.

The wireless sniffer 130 may be configured to monitor for nefarious ormalicious actions by third parties. In these and other embodiments, thewireless sniffer 130 may monitor for states that may indicate thepresence of a distribution denial of service (DDOS) attack, a virus,malware, or some other activity of an unauthorized device. For example,the wireless sniffer 130 may monitor for a flooding increase of networkactivity, even if from multiple sources, and providing data to the cloudsystem 140 such that corrective action may be taken (e.g., blockingcertain ranges of IP addresses, etc.). In these and other embodiments,corresponding data regarding the attacks may be provided by the AP 110.

The cloud system 140 may include any remote computing device incommunication with the APs 110 and/or the wireless sniffers 130. Forexample, the cloud system 140 may include a cloud-hosted server able toutilize large pools of storage and/or processing resources for aneconomical price. The cloud system 140 may be remotely accessible for anadministrator or other user. Some examples of the cloud system 140include Amazon® Web Services, Google® Cloud Platform, Microsoft® Azure,etc.

In some embodiments, the cloud system 140 may be configured to sendcommands to and/or receive data from any of the other components of theenvironment 100 to change their respective modes of operation. Forexample, the cloud system 140 may send a message to the AP 110 to changea frequency or channel upon which it is broadcasting, to change itsbroadcasting power, to change bandwidth of a broadcasting channel, totoggle between multi-user, multiple-input, multiple-output (MU-MIMO) andsingle-user (SU)-MIMO, to switch on or off beam-forming to a particularSTA 120, to power cycle, to change a receiving sensitivity, to changeAggregated MAC Protocol Data Unit (AMPDU)/Aggregated MAC Service DataUnit (AMSDU) aggregation sizes, etc., or any other feature or setting inthe AP that may be turned on or off. In these and other embodiments,doing so may facilitate STAs 120 in joining the wireless network of theAP 110. Additionally or alternatively, such a message may changesettings of the AP 110 such that it blocks or otherwise counteracts anattack (e.g., a DDOS attack) without human intervention. As anotherexample, the cloud system 140 may send a message to the STA 120 tochange settings of a wireless network card or chip, disable and/orreenable the wireless network card or chip, power cycle, suppress apower-saving mode, etc., or any other network-impacting feature orsetting in the AP that may be turned on or off. As a further example,the cloud system 140 may be configured to send commands and/or receivedata from the wireless sniffer 130. In some embodiments, the cloudsystem 140 may transmit a command to the wireless sniffer 130 to changea mode of operation or to request data. For example, the cloud system140 may send a command to the wireless sniffer 130 to listen on acertain channel or frequency, to change a duration during which thewireless sniffer 130 collects data, to impose a filter on the datacollected by the wireless sniffer 130, to change channels or frequenciesat a certain rate, etc. As another example, the cloud system 140 mayrequest that the last thirty seconds of data obtained by the wirelesssniffer 130 and/or the next thirty seconds of data obtained by thewireless sniffer 130 be transmitted to the cloud system 140.

In some embodiments, the environment 100 may permit quick setup of awireless sniffer 130 and calibrate the wireless sniffer 130 for a localenvironment/premise without the use of a field engineer that travels tothe premise. For example, the cloud system 140 may instruct the wirelesssniffer 130 to remotely start obtaining data on specified channel(s),one or both frequency bands (e.g., 2.4 or 5 GHz), store the obtaineddata on local storage of the wireless sniffer 130 (and/or a computingdevice communicatively coupled to the wireless sniffer 130, such as alaptop), remotely initiate upload of sniffer data for a specific windowof time to the cloud system 140, receive notification when such anupload is complete, etc.

In some embodiments, local configuration and/or control of the wirelesssniffer 130 may include install of a software program or packagepermitting remote access to the wireless sniffer 130 (such as a remoteprocedure call (RPC) package), positioning of the wireless sniffer 130.In some embodiments, the wireless sniffer 130 may receive remoteinstructions for automated implementation of local operations. Forexample, the wireless sniffer 130 may include a visual indicator (e.g.,LCD, LED, etc.) or a mobile smartphone app may be used to assist anon-trained end user (e.g., not a field engineer or technician) forlocation placement, management, etc. For local control of the sniffer, acommand line interface (CLI) tool or single page web application (SPA)may be used, whether directly to the wireless sniffer 130 or to anassociated computing device (such as a control laptop, etc.).

In an example implementation, a user may initially setup the wirelesssniffer 130 using guiding instructions, such as connecting to a localweb interface of the wireless sniffer 130, obtaining a registrationcode, using the registration code to register the wireless sniffer 130using credentials, providing a name or other identifier for the wirelesssniffer 130, initialize the remote access to the wireless sniffer 130,and/or using a verification process to verify and/or authenticate thewireless sniffer 130 with the cloud system 140 (e.g., using a standardOauth2 security scheme using physical access to the wireless sniffer 130and credentials of the cloud system 140 with some registration codetying the two credentials together). Based on data obtained by thewireless sniffer 130, the user may be provided instructions to change ormodify the location of the wireless sniffer 130 until it is at a desiredlocation (e.g., at a location proximate a given STA 120, etc.). Afterthese steps have been completed, the operation of the wireless sniffer130 may be controlled by the cloud system 140.

In some embodiments, the cloud system 140 may correlate data frommultiple devices in the environment such that events at the same timemay be observed from the perspective of multiple devices (e.g., fromboth the wireless sniffer 130 and the AP 110). Such correlation mayinclude a temporal correlation by which data from multiple devices maybe designated as corresponding to the same point in time. Such temporalcorrelation may include data from the AP 110 and the wireless sniffer110 being time stamped reliably, for example by using the Network TimeProtocol (NTP). In these and other embodiments, the cloud system 140 mayperform analysis on the data to detect an error and/or determine apotential solution or remedy for an error. Various examples of suchanalysis, detection, etc. are described throughout the presentdisclosure.

Modifications, additions, or omissions may be made to the environment100 without departing from the scope of the present disclosure. Forexample, the designations of different elements in the manner describedis meant to help explain concepts described herein and is not limiting.Further, the environment 100 may include any number of other elements ormay be implemented within other systems or contexts than thosedescribed. For example, any number of wireless sniffers 130 and/or APs110 servicing any number of STAs 120 may be included in the environment.

FIG. 2 illustrates another example operating environment 200 that mayimplement remote management of a wireless sniffer 230, in accordancewith one or more embodiments of the present disclosure. The environment200 may be similar or comparable to the environment 100, with similarlynumbered elements. For example, the environment 200 may include APs 210(such as the APs 210 a, 210 b, 210 n), STAs 220 (such as the STAs 220 a,220 b), wireless sniffers 230 (such as the wireless sniffers 230 a, 230b, and 230 n), and a cloud system 240, which may be similar orcomparable to the APIs 110, STAs 120, wireless sniffers 130, and/or thecloud system 140, respectively. The environment 200 may additionallyinclude a premise 250 within which WLANs may be observed, and thepremise may include one or more walls 252 separating the premise intoindividual spaces (e.g., apartments, businesses, etc.). The environment200 may additionally include a wireless AP 212 that may be connectedwithin an individual space, which may also include one or more devicesoperating within a wireless signal space, including a wireless telephone251, a camera 252, and an appliance 253.

In some embodiments, various problems may be created at the premise 250that the environment may help alleviate. For example, the wirelesstelephone 251, the camera 252, and/or the appliance 253 may broadcastand/or be operating in a frequency range and/or a channel that may causeinterference with and/or degrade the wireless signal of the AP 210 b inan adjacent individual space at the premise 250. As another example, theSTA 220 b may move beyond the range of the AP 210 b and/or connect toanother AP, such as the AP 212. As an additional example, a filetransfer to or from the STA 220 a may be interrupted.

While examples are provided, the present disclosure may include a seriesof scripts or other operations that may be performed to iterativelyaddress potential issues or causes of observed problems in the wirelessnetwork. Such scripts may vary depending on a determined state of thesystem and the analyzed data obtained from the wireless sniffer 230and/or the AP 210. In these and other embodiments, such debugging mayresult in modification of operation of one or more devices within thewireless network. After such modification, the wireless sniffer 230and/or the AP 210 may continue to provide data to the cloud system 240to validate whether or not the issue has been resolved/the performanceimproved. If the issue is alleviated but not completely resolved, thescripts may continue to run. In some embodiments, the use of suchiterative data, including modification of operation of various devices,may result in a feedback loop via which the network may be modified,data may be collected in the modified network, and the network may befurther modified.

With respect to the interference from the wireless telephone 251, thecamera 252, the appliance 253, and/or the wireless AP 212, the use ofthe wireless sniffers 230 may facilitate addressing the problem.Following such an example, the AP 210 b and/or the STA 220 b may send amessage to the cloud system 240 of signal degradation and/or difficultyin connecting or remaining connected. For example, a number thresholdnumber of connection requests or reconnections may trigger a messagebeing sent to the cloud system 240. Based on receiving the message, thecloud system 240 may send a message to one or more of the wirelesssniffers (such as the wireless sniffers 230 b and 230 c) to obtain datain the frequency and channel at which the AP 210 b is broadcasting.Additionally or alternatively, the cloud system 240 may send a messageto the wireless sniffer 230 b to obtain data at the frequency andchannel at which the AP 210 b is broadcasting, and may send a message tothe wireless sniffer 230 c to obtain data at multiple potentialfrequencies and/or channels which the API 210 b may switch to instead ofits current channel. The cloud system 240 may request the packet loggerdata from the API 210 b to observe what occurred in the signal strength,and may observe the time-correlated data from the wireless sniffer(s)230 b and/or 230 c. Based on the data, the cloud system 240 may observethat the wireless telephone 251, the camera 252, the appliance 253,and/or the wireless AP 212 are causing interference at a certain channelor frequency, and may send an instruction to the API 210 b to changechannels and/or frequencies over which it is broadcasting. In someembodiments, such a change may be informed and/or guided based onadditional data from the wireless sniffer 230 c obtaining data forpotential new channels and/or frequencies for the AP 210 b.

Continuing the example of interference, if the STA 220 b is connected tothe AP 210 a, the AP 210 a may not sense any signal causing interferenceat the channel or frequency at which it is broadcasting. For example,the API 210 a may include a wireless sniffer 230 a that may obtain dataregarding the channel. However, by using the wireless sniffers 230 band/or 230 c, the cloud system 240 may identify interference from thewireless telephone 251, the camera 252, the appliance 253, and/or thewireless AP 212 that may be causing interference for the STA 220 b.Based on the information from the wireless sniffers 230 b and/or 230 c,the cloud system 240 may be able to observe the interference where theAPI 210 a and/or the wireless sniffer 230 a may not observe suchinterference.

Turning now to the example of the STA 220 b moving beyond the range ofthe AP 210 b and/or connect to the AP 212, the lack/change in connectionmay be analyzed and improved using a remote wireless sniffer. Thewireless sniffer 230 b may be enabled at the same individual space inthe premise 250 as the AP 210 b, and may be configured to run on thesame channel and/or frequency as the AP 210 b, and to continuouslycapture wireless traffic on the channel of the AP The wireless sniffer230 b may be synchronized to the same time as the cloud system 240and/or the API 210 b. An alert may be enabled to detect when the STA 220b disconnects, such as a syslog based trigger searching for the givenMAC address ‘xx:yy:zz:aa:bb:cc’ of the STA 220 b and a string similar to“wifi2_0: xx:yy:zz:aa:bb:cc disassociated” where wifi2_0 may correspondto the Wi-Fi signal broadcast by the API 210 b. In operation, the STA220 b may connect successfully into the network broadcast by the API 210b, and may pass Wi-Fi traffic successfully. At a time (‘t’), a user ofthe STA 220 b may move with the STA 220 b to the very edge of thewireless network broadcast by the API 210 b where the signal to noiseratio is marginal. At this point, the STA 220 b may lose its connectionwith the AP 210 b due to the nature of the wireless signal beingmarginal (e.g., the STA 220 b may find that the signal from the AP 212may be stronger and so may disconnect from the AP 210 b and connect tothe API 212). Such an occurrence may trigger an event at the cloudsystem 240 at time t. In response, the cloud system 240 may send amessage to the wireless sniffer 230 b to obtain traces for a time windowof t−30 seconds to t+30 seconds. In some embodiments, the wirelesssniffer 230 b may collect data until t+30, and may be received by thecloud system 240 at a time t+30+Δ, where Δ represents the time taken forthe wireless sniffer 230 b to process the request and send the obtainedtrace data.

Continuing the example, the cloud system 240 may utilize as input thewireless sniffer 230 b trace files as gathered as described above, andthe MAC address of the STA 220 b (e.g., xx:yy:zz:aa:bb:cc), and mayanalyze data pertinent to data retry, authentication/association, anddata pertinent to the PHY rate. Using such data, the cloud system 240may generate a number of graphs illustrating how the PHY rate variesacross time, packet transmissions and retransmissions to and from theSTA 220 b, and/or wireless sniffer traces (whether partial or full) fromthe wireless sniffer 230 b showing attempted connection/reconnectionevents for the STA 220 b. Additionally or alternatively, the cloudsystem 240 may request and/or otherwise obtain or access packet loggerdata from the AP 210 b (and/or per node physical statistics ifavailable) from time t−30 seconds to t+30 seconds, and may run ananalysis on such files to extract relevant data related to the given MACaddress. Using such information, the cloud system 240 may take the pernode PHY stats data for the STA 220 b, and may plot the digital backoffvalue (e.g., an integer value between 0 and 6, representing 0 dB to 12dB of digital backoff) and may provide a plot over time against thedigital backoff applied to the connection to the STA 220 b. Such a plotmay be overlaid or otherwise correlated with the graphs generated basedon the data from the wireless sniffer 230 b. Such correlated informationand/or graphs may be presented on a graphical web page containing alland/or portions of the data in the one location.

In some embodiments, the cloud system 240 may analyze the data. In doingso, the cloud system 240 may determine that there are many retries ofpackets around the time of the event t, and a similar large number ofretries from time t to time t+30. The cloud system 240 may additionallyanalyze the PHY rate variation data and may determine that the PHY rateof transmitted packets to the STA 220 b drops from time t−30 to t. Fromtime t to time t+30, the PHY rate to the STA 220 b may remain at a verylow value. Additionally, in analyzing the data, the cloud system 240 maydetermine that the STA 220 b may have difficulty in reconnecting back tothe AP 210 b from time t to t+30, as shown by many attempted‘authentication’, ‘association’ and possibly Extensible AuthenticationProtocol (EAP) over Local Area Network (LAN) (EAPOL) frame exchangeswhich repeat multiple times without success (e.g., there are manyretries and authentication restarts a number of times).

Additionally or alternatively, the cloud system 240 may analyze thedigital backoff for the STA 220 b (xx:yy:zz:aa:bb:cc) as plotted againsttime t−30 to t+30, and may determine that the digital backoff applied tothe given client varies from an integer value of 6 (12 dB backoff) to 0(no backoff, e.g., maximum transmit power, with a maximum power of 12dBm used). The cloud system 240 may examine the other output from the AP210 b, which may include detail of the maximum allowed transmit powerbeing 12 dBm. The cloud system 240 may determine that the maximumtransmit power for the AP 210 b may be set to a very low value withinthe configuration for the AP 210 b (e.g., a maximum transmit power of 12dBm). By combining the various data and analyses, the cloud computingsystem 240 may identify a cause of the problem (low maximum transmitpower), and may send a message to address the problem (e.g., sending amessage to the AP 210 b to adjust the maximum transmit power to a highervalue as allowed by local regulations (18 dBm)).

To verify the effect of the operation of the cloud system 240 ataddressing the issue, the user of the STA 220 b may perform a similartask of moving with the STA 220 b to the same location the problem wasexperienced before. During such a task, the cloud system 240 may monitordata from the AP 210 b for repeated attempts atauthentication/association to verify the problem was solved.

Turning to the example of a file transfer to or from the STA 220 a beinginterrupted, an alert may be configured to trigger based on a packetlogger statistic associated with the AP 210 a to indicate when data lossoccurs on the egress port of the AP 210 a. A user of the STA 220 a mayconnect to a wireless network via the AP 210 a and may leave anetworking page open at a network list page. The user may then start alarge file transfer from the wireless network via the AP 210 a, whichshows stops and starts (at time ‘a’, ‘b’, ‘c’, . . . ). At points ‘a’,‘b’, ‘c’, . . . , the cloud system 240 may trigger an alert, which mayin turn cause the cloud system 240 to send a message to the wirelesssniffer 230 a to obtain and upload the traces for times a−30 seconds toa+30 seconds, b−30 seconds to b+30 seconds, etc. The cloud system 240may utilize the MAC address of the STA 220 a to request data from the AP210 a regarding data retry, the PHY rate with the STA 220 a, etc. Insome embodiments, the cloud system 240 may generate a series of timevarying graphs plotting power save transitions per MAC address (whichmay be obtained from the STA 220 a and/or the AP 210 a), and a series oftime varying graphs plotting the PHY rate per MAC address. In someembodiments, the cloud system 240 may gather packet logger data (e.g.,statistical data) for the AP 210 a for the time periods a−30 seconds toa+30 seconds, b−30 seconds to b+30 seconds, etc. Using such data, thecloud system 240 may generate a time series graph showing the number ofdrops experienced on the WLAN egress port. In these and otherembodiments, the cloud system 240 may present a graphical web pagecontaining all of the collected data and or graphs generated, and maypresent them in a temporally correlated manner.

Using the collected data, the cloud system 240 may identify that the STA220 a may be entering power save at times ‘a’, ‘b’, ‘c’, . . . andexiting power save mode at times ‘a+δ’, ‘b+δ,’ ‘c+δ,’ . . . , where δmay represent some time period. The cloud system 240 may additionallyidentify an output for PHY rate for the STA 220 a and may determines thePHY rate is stable at a given rate (e.g., 866 Mbps), with gaps in thegraph (e.g., due to no transmissions) at timestamps ‘a’, ‘b’, ‘c’, . . ..

Given the information, the cloud system 240 may determines that thetimeline of the of drop in service on the WLAN egress port matches witheach instance of power save transitions for the STA 220 a. That is, thecloud system 240 may determine there are spikes in the graph of drops onthe WLAN egress port from time ‘a’ to ‘a+δ’, ‘b’ to ‘b+δ’, . . . . Basedon the determination, the cloud system 240 may determine that the causeof the stalled download is due to the STA 220 a entering and exitingpower save mode and causing WLAN egress packet drops. The cloud systemmay send a message to the user of the STA 220 a to close the networklist page in order to prevent power save transitions occurring duringWi-Fi network scan, which occurs whenever the network list page is open.Additionally or alternatively, the cloud system 240 may send a messageto the STA 220 a that automatically closes the network list page orotherwise changes a setting to modify operation of the power save modeto prevent the drop in service.

For each of the examples provided herein, and other resolution ofpotential issues in the wireless network, the actual cause may bedetermined via the use of a debugging script via which one or more mostlikely causes of the issue may be checked first, followed by otherpotential causes. In some embodiments, such issues may include the AP230 rebooting or crashing, a complete wireless transmission or receivingfailure for one or all STA 220, a failure of a network card or chip inthe AP 230, continuous association and dissociation by the STA 220, afailure to associate by the STA 220, continuous band-steering (e.g.,when the 5 GHz band is congested, not working properly, etc.), and/orupper layer issues such as host-side issues (e.g., Internet serviceprovider (ISP) issues, Data Over Cable Service Interface Specification(DOCSIS) issues, etc.).

While certain analysis and detection operations are described as beingperformed by the cloud system 240, it will be appreciated that suchobservation and/or analysis of data and/or graphs may be performed by ahuman operator, such as an administrator or network technician. In theseand other embodiments, the cloud system 240 may be configured to obtainand generate a display of the collected data (whether graphically orotherwise).

In some embodiments, the cloud system 240 may utilize a machine learningsystem or other pattern-identifying system to observe data from wirelesssniffer 230 and the AP 210 and may use that data to identify a state ofthe overall system. For example, over time, the cloud system 240 mayobserve that certain trends in data correspond to certain errors suchthat they may be more readily and quickly addressed and solved. In someembodiments, the cloud system 240 may utilize data specific to aparticular radio antenna of the AP 210, such as a short preamble decodeerror, a long preamble decode error, a cyclic redundancy check (CRC)error, a number of hardware vs. software buffer retries, a number ofdefers, the per chain transmit power, the noise floor for the radioantenna, the number of neighbor service set identifiers (SSIDs) that areon-channel and/or off-channel, and/or a number of beaconsuccess/failures. In some embodiments, the cloud system 240 may utilizedata specific to a particular STA 220, such as a per packet powercontrol backoff (in dB), a size of an aggregated MAC service data unit(AMSDU) and/or aggregated multiple AMSDUs (AMPDU), beamformingcapabilities available to the STA, MU-MIMO capabilities and/or usagestats of the STA, per chain received signal strength indicator (RSSI),error vector magnitude (EVM), received channel power indicator (RCPI),etc.

In some embodiments, the wireless sniffer 230 itself may be configuredto monitor for certain errors. For example, the cloud system 240 mayprovide the wireless sniffer 230 a set number of conditions that maypredictably correlate to a certain state of the system. Using suchconditions, the wireless sniffer 230 may monitor for the existence ofsuch a condition and may trigger a solution itself if the data providedby the cloud system 240 includes the solution. Additionally oralternatively, the wireless sniffer 230 may alert the cloud system 240when such a condition is met.

Modifications, additions, or omissions may be made to the environment200 without departing from the scope of the present disclosure. Forexample, the designations of different elements in the manner describedis meant to help explain concepts described herein and is not limiting.Further, the environment 200 may include any number of other elements ormay be implemented within other systems or contexts than thosedescribed. Additionally, while a small number of examples have beenprovided, any number of triggers may be included, any number of devicesmay be queried to provide data, any number of data analyses may beincluded, and/or any number of data visualizations may be generated.

FIG. 3 is a block diagram of an example system with a wireless sniffer330 in communication with a cloud system 340, in accordance with one ormore embodiments of the present disclosure. The wireless sniffer 330 maybe similar or comparable to the wireless sniffer 130 and/or the wirelesssniffer 230 of FIGS. 1 and 2, respectively. The cloud system 340 may besimilar or comparable to the cloud system 140 and/or the cloud system240 of FIGS. 1 and 2, respectively.

As illustrated in FIG. 3, the wireless sniffer 330 may include acontroller 331, a wireless network chip or card 333, a storage 335, aLong Term Evolution (LTE) card 337, and/or an ethernet adapter 339.

The controller 331 may include any suitable special-purpose orgeneral-purpose computer, computing entity, or processing deviceincluding various computer hardware or software modules and may beconfigured to execute instructions stored on any applicablecomputer-readable storage media. For example, the controller 331 mayinclude a microprocessor, a microcontroller, a digital signal processor(DSP), an application-specific integrated circuit (ASIC), aField-Programmable Gate Array (FPGA), or any other digital or analogcircuitry configured to interpret and/or to execute program instructionsand/or to process data. In some embodiments, the controller 331 mayoperate using a particular operating system (OS), such as Linux®.

In some embodiments, the controller 331 may be configured to fetchprogram instructions from the storage 335 and perform the programinstructions. Additionally or alternatively, the controller 331 mayreceive instructions to perform operations directly or indirectly fromthe cloud system 340.

The wireless network chip or card 333 may include any device, system, orcomponent to permit the wireless sniffer 330 to listen to and/or obtaindata from a wireless network. For example, the wireless network chip orcard 333 may include an antenna and/or chipset configured to operate ina promiscuous mode such that the wireless network chip or card 333obtains all packets to which the wireless sniffer 330 is exposed. Inthese and other embodiments, the wireless network chip or card 333 maybe configured to operate at a given channel and/or frequency (e.g.,channel 100 in the 2.4 GHz band).

The storage 335 may include any component, device, or system configuredto store data, such as the data collected and/or observed by thewireless network chip or card 333. The storage 335 may be readable bycomputers or computing devices, such as the controller 331 and/or thecloud system 340. By way of example, and not limitation, the storage 335may be implemented as Random Access Memory (RAM), Read-Only Memory(ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM),optical disk storage, magnetic disk storage or other magnetic storagedevices, flash memory devices (e.g., solid state memory devices), or anyother storage medium which may be used to carry or store desired programcode in the form of computer-executable instructions or data structuresand which may be accessed by a general-purpose or special-purposecomputer. In some embodiments, the storage 335 may store triggers andcorresponding actions, a rolling buffer of data observed, settings orother parameters informing a mode of operation of the wireless sniffer330 (e.g., upon which channel/frequency the wireless sniffer 330 is tobe obtaining data), etc.

The LTE card 337 may include any communication device or componentconfigured to communicate with the could system 340. In someembodiments, the LTE card 337 may be configured to communicate over adifferent network or communication modality as compared to the wirelessnetwork chip or card 333. For example, the LTE card 337 may permit thewireless sniffer 330 to communicate over cellular networks without theuse of a Wi-Fi signal. By communicating over a different modality, ifthe Wi-Fi network to which the wireless network chip or card 333 islistening has errors or problems communicating, the wireless sniffer 330may still be able to communicate with the cloud system 340 via the LTEcard 337.

The ethernet adapter 339 may include any communication device orcomponent configured to communicate with other devices over a wiredconnection. For example, the ethernet adapter 339 may include a card orchip configured to provide wired connectivity to a network and/or toanother device. For example, the ethernet adapter 339 may be used toprovide a wired connection to a secondary computing device that providesadditional processing and/or storage capabilities to the wirelesssniffer 330. Additionally or alternatively, the secondary computingdevice may provide a user interface via which a user may observe agraphical user interface (GUI) or command line interface (CLI) and/ormay type, click, swipe, tap, etc. to interact with and provide commandsor instructions to the wireless sniffer 330.

In some embodiments, the ethernet adapter 339 may provide a secondarychannel of communication in a network. For example, the wireless networkcard or chip 333 may obtain data regarding wirelessly transmittedpackets in a network, and the ethernet adapter 339 may provide wiredaccess to the same network. In these and other embodiments, the ethernetadapter 339 may be used to communicate with the cloud system 340 ratherthan or in addition to the LTE card 337.

Modifications, additions, or omissions may be made to the system 300and/or the wireless sniffer 330 without departing from the scope of thepresent disclosure. For example, the designations of different elementsin the manner described is meant to help explain concepts describedherein and is not limiting. Further, the system 300 and/or the wirelesssniffer 330 may include any number of other elements or may beimplemented within other systems or contexts than those described.

FIG. 4 is an example visualization 400 of time correlated data, inaccordance with one or more embodiments of the present disclosure. Thevisualization 400 may represent one or more of the graphs generated bythe cloud system 140, 240 and/or 340 of FIGS. 1-3.

As illustrated in FIG. 4, the visualization 400 may include data 410representing switch processor (SP) errors at an AP acquired and/orobtained from the AP. The visualization 400 may additionally includedata 420 representing a number of Ready to Send (RTS) packets per second(PPS) as observed by a wireless sniffer. The two sets of data may becorrelated in time such that events and/or occurrences between the twosets of data may be readily observed.

In some embodiments, additional data from either of the AP and/or thewireless sniffer may be displayed visually. The data may be displayed onthe same visualization 400 (e.g., overlaid on the same time scale) or ona separate visualization that may include the same or a similar timewindow for visualization. Such data may include broadcast strength ofthe AP wireless channel, a number of block ACKs detected by the wirelesssniffer per second, an AP modulation coding scheme (MCS) rate to aspecific client or series of clients, etc.

Modifications, additions, or omissions may be made to the visualization400 without departing from the scope of the present disclosure. Forexample, any number of data sets may be included and may be illustratedusing any graphical style. As another example, rather than a graphicaldepiction, a tabular form or other depiction of raw data may beincluded.

FIG. 5 is a flowchart of an example method 500 of remote management of awireless sniffer, in accordance with one or more embodiments of thepresent disclosure. The method 500 may be implemented, in whole or inpart, by one or more of the cloud system 140, the wireless sniffer 130,the AP 110; the cloud system 240, the wireless sniffer 230, the AP 210;the cloud system 340, and/or the wireless sniffer 330 of FIGS. 1, 2, and3 respectively, or any combinations thereof.

At block 510, a notification may be obtained of an error event at apremise with a wireless network. For example, an administrator or otheruser may set one or more conditions as error events that may cause adevice communicating on the wireless network to send the notification toa cloud system (such as the cloud system 140, 240, or 340 of FIG. 1, 2,or 3, respectively). In some embodiments, the notification may beprovided by an AP (such as the AP 110 or 210 of FIG. 1 or 2,respectively), a STA (such as the STA 120 or 220 of FIG. 1 or 1,respectively), and/or a wireless sniffer (such as the wireless sniffer130, 230, or 330 of FIG. 1, 2, or 3, respectively). Some examples ofsuch error events include exceeding a threshold number ofassociation/disassociations, exceeding a threshold number of times thesame packet is sent, quantity of network traffic for a device droppingbelow a threshold, inability to connect or stay connected to a wirelessnetwork, etc.

In some embodiments, the notification may be detected by the cloudsystem itself. For example, one or more of the devices operating inand/or associated with the wireless network may periodically, regularly,or continuously provide data to the cloud system (e.g., unlessinstructed otherwise, the wireless sniffer may gather twenty seconds ofdata every ten minutes and provide it to the cloud system, regardless ofwhether or not the wireless sniffer received a trigger or otherinstruction to obtain data). The cloud system may monitor and/or analyzethe data to detect such an error event or trigger.

At block 520, a trigger may be sent to a wireless sniffer at thepremise. For example, based on the error event, the cloud system maysend the trigger to the wireless sniffer to cause the wireless snifferto obtain data at a particular broadcast frequency and/or channel. Insome embodiments, the trigger may include instructions of whichbroadcast frequency and/or channel upon which the wireless sniffer is toobtain data. In some embodiments, the trigger may include an instructionthat causes the wireless sniffer to send previously obtained data. Forexample, if the wireless sniffer keeps a rolling buffer of the lastthirty seconds of data, the trigger may cause the wireless sniffer tosend the previously obtained last thirty seconds (e.g., t−30 seconds)and the next thirty seconds (e.g., t+30 seconds) of data.

In some embodiments, the trigger may be sent based on data previouslyobtained by the cloud system. For example, the trigger may cause thewireless sniffer to obtain data at a different channel or frequency thanthe wireless sniffer was operating on previously. In this manner, thecloud system may operate in a feedback loop to adjust the wirelesssniffer based on previously obtained data from the wireless sniffer.

At block 530, sniffer data for a window of time may be obtained. Forexample, the wireless sniffer may send the obtained data to the cloudsystem. Following the example above, the window of time may include thewindow with t−30 seconds and t+30 seconds of data.

At block 540, corresponding data from an AP may be obtained for at leastpart of the window of time for which the sniffer data was obtained. Forexample, the cloud system may request that the AP provide packet loggerdata, an error log, STA-specific data (e.g., based on MAC address), orother data from the AP for another window of time that at leastpartially overlaps in time with the sniffer data. In some embodiments,the AP data and the sniffer data may cover the same window of time.

At block 550, the sniffer data and the corresponding AP data may betemporally correlated. For example, the sniffer data and thecorresponding AP data may be graphically depicted on a time scalesharing the same time axis such that corresponding events between thetwo data sets may be observed on a temporal scale. As another example,the sniffer data and the corresponding AP data may be interleaved intime such that corresponding events may be observed in a tabular orother data depiction format.

At block 560, the sniffer data and the corresponding AP data may beanalyzed to assess performance of the wireless network. For example, thesniffer data and the corresponding AP data may be analyzed to determinewhether or not an error or triggering event has occurred, whether or notan improvement in performance may be obtained or if other optimizationof the wireless network is warranted, whether or not a configuration ofthe wireless network may benefit from being modified, etc. In these andother embodiments, the sniffer data and/or the corresponding AP data maybe analyzed by an administrator, technician, or other user. Additionallyor alternatively, the cloud system may automatically analyze the data,such as by using a machine learning or artificial intelligence system.In these and other embodiments, a set of conditions may be correlated toa state and a predictive model may be used to predict or otherwiseestimate an area in which the wireless network may improve performanceor some other issue with the wireless network. In some embodiments, theanalysis may identify an issue deserving attention based on conditionsexisting at the same or similar point in time in one or both of the datasets. Examples of such causes may include interference with the wirelesssignal of an AP, insufficient broadcasting strength of an AP, a STAgoing into a power saving mode, etc.

At block 570, an issue with the performance of the wireless network maybe debugged. For example, the cloud system may obtain or otherwiseidentify an issue with the wireless network at the block 560. The cloudsystem may initiate a series of scripts or other processes that may gothrough a series of steps to intelligently identify the cause of theissue and a resolution of the issue based on the wireless sniffer dataand/or the corresponding AP data. For example, the scripts mayautomatically rule out the most likely causes of the issue based on theexpected state of the wireless network based on the wireless snifferdata and the corresponding AP data. Continuing the example, if a STA isexperiencing slow loading or poor wireless performance, the debuggingscript may first check for interference from an unknown node (e.g., theAP 212 in FIG. 2), may second check for the number of STAs and theirusage in the current wireless network, may third check the number ofpacket drops for the particular STA experiencing the issue, may fourthcheck the broadcasting power of the AP, may fifth check any power-savingissues at the AP and/or the STA may sixth check for known issues ofpacket drops on the wired network and/or DOCSIS side, etc. In these andother embodiments, the scripts may be updated or modified based onmachine learning or other data analysis performed by the cloud systemsuch that the operation of the debugging may identify issues and theirresolutions, and the cloud system may better correlate the given stateof the wireless network with the given issue such that the debuggingscripts may more readily arrive at the cause of the issue. The cloudsystem may utilize a feedback loop of the obtained data and thedebugging to create more focused and effective debugging scripts.

At block 580, a message may be transmitted to at least one of the AP,the wireless sniffer, and/or the STA based on the analyzed sniffer dataand corresponding AP data of the block 560 and/or the debugging of theblock 570. For example, the cloud system may send instructions to the APto change a channel or frequency it is using, to increase itsbroadcasting strength, or other remedial action to address a cause ofthe error. As another example, the cloud system may send instructions tothe STA to disable a power-saving feature, to disable and reenable awireless network card or chip, etc. In some embodiments, the message maybe for a purpose other than directly addressing the cause of the error.For example, the message may cause the wireless sniffer to obtain dataon a different channel or frequency, or to alternate between multiplefrequencies and/or channels such that the cloud system may haveadditional data to provide a recommendation for addressing the cause ofthe error.

One skilled in the art will appreciate that, for this and otherprocesses and methods disclosed herein, the functions performed in theprocesses and methods may be implemented in differing order. Forexample, the operations 520, 530, and 540 may be performed in adifferent order, simultaneously, etc. Furthermore, the outlined stepsand operations are only provided as examples, and some of the steps andoperations may be optional, combined into fewer steps and operations, orexpanded into additional steps and operations without detracting fromthe essence of the disclosed implementations.

FIG. 6 illustrates an example computing system 600 associated withremote management of a wireless sniffer, according to at least oneembodiment described in the present disclosure. The computing system 600may include a processor 610, a memory 620, a data storage 630, and/or acommunication unit 640, which all may be communicatively coupled. Any orall of the wireless sniffers, APs, STAs, and/or cloud systems of FIGS.1-3 may be implemented by a computing system consistent with thecomputing system 600. Additionally or alternatively, any of theoperations of the method 500 of FIG. 5 may be performed by a computingsystem consistent with the computing system 600. For example, thecomputing system 600 may obtain sniffer data and AP data, and maycorrelate that data and use the correlated data to facilitate predictionof a cause of an error.

Generally, the processor 610 may include any suitable special-purpose orgeneral-purpose computer, computing entity, or processing deviceincluding various computer hardware or software modules and may beconfigured to execute instructions stored on any applicablecomputer-readable storage media. For example, the processor 610 mayinclude a microprocessor, a microcontroller, a digital signal processor(DSP), an application-specific integrated circuit (ASIC), aField-Programmable Gate Array (FPGA), or any other digital or analogcircuitry configured to interpret and/or to execute program instructionsand/or to process data.

Although illustrated as a single processor in FIG. 6, it is understoodthat the processor 610 may include any number of processors distributedacross any number of network or physical locations that are configuredto perform individually or collectively any number of operationsdescribed in the present disclosure. In some embodiments, the processor610 may interpret and/or execute program instructions and/or processdata stored in the memory 620, the data storage 630, or the memory 620and the data storage 630. In some embodiments, the processor 610 mayfetch program instructions from the data storage 630 and load theprogram instructions into the memory 620. After the program instructionsare loaded into the memory 620, the processor 610 may execute theprogram instructions, such as instructions to perform any of theoperations of the method 500 of FIG. 5.

The memory 620 and the data storage 630 may include computer-readablestorage media or one or more computer-readable storage mediums forcarrying or having computer-executable instructions or data structuresstored thereon. Such computer-readable storage media may be anyavailable media that may be accessed by a general-purpose orspecial-purpose computer, such as the processor 610. In someembodiments, the computing system 600 may or may not include either ofthe memory 620 and the data storage 630.

By way of example, and not limitation, such computer-readable storagemedia may include non-transitory computer-readable storage mediaincluding Random Access Memory (RAM), Read-Only Memory (ROM),Electrically Erasable Programmable Read-Only Memory (EEPROM), CompactDisc Read-Only Memory (CD-ROM) or other optical disk storage, magneticdisk storage or other magnetic storage devices, flash memory devices(e.g., solid state memory devices), or any other storage medium whichmay be used to carry or store desired program code in the form ofcomputer-executable instructions or data structures and which may beaccessed by a general-purpose or special-purpose computer. Combinationsof the above may also be included within the scope of computer-readablestorage media. Computer-executable instructions may include, forexample, instructions and data configured to cause the processor 610 toperform a certain operation or group of operations.

The communication unit 640 may include any component, device, system, orcombination thereof that is configured to transmit or receiveinformation over a network. In some embodiments, the communication unit640 may communicate with other devices at other locations, the samelocation, or even other components within the same system. For example,the communication unit 640 may include a modem, a network card (wirelessor wired), an optical communication device, an infrared communicationdevice, a wireless communication device (such as an antenna), and/orchipset (such as a Bluetooth device, an 802.6 device (e.g., MetropolitanArea Network (MAN)), a Wi-Fi device, a Wi-Max device, cellularcommunication facilities, or others), and/or the like. The communicationunit 640 may permit data to be exchanged with a network and/or any otherdevices or systems described in the present disclosure. For example, thecommunication unit 640 may allow the system 600 to communicate withother systems, such as computing devices and/or other networks.

One skilled in the art, after reviewing this disclosure, may recognizethat modifications, additions, or omissions may be made to the system600 without departing from the scope of the present disclosure. Forexample, the system 600 may include more or fewer components than thoseexplicitly illustrated and described.

An example apparatus can include a Wireless Access Point (WAP) or astation and incorporating a VLSI processor and program code to support.An example transceiver couples via an integral modem to one of a cable,fiber or digital subscriber backbone connection to the Internet tosupport wireless communications, e.g. IEEE 802.11 compliantcommunications, on a Wireless Local Area Network (WLAN). The WiFi stageincludes a baseband stage, and the analog front end (AFE) and RadioFrequency (RF) stages. In the baseband portion wireless communicationstransmitted to or received from each user/client/station are processed.The AFE and RF portion handles the upconversion on each of transmitpaths of wireless transmissions initiated in the baseband. The RFportion also handles the downconversion of the signals received on thereceive paths and passes them for further processing to the baseband.

An example apparatus can be a MIMO apparatus supporting as many as N×Ndiscrete communication streams over N antennas. In an example the MIMOapparatus signal processing units can be implemented as N×N. In variousimplementations, the value of N can be 4, 6, 8, 12, 16, etc. ExtendedMIMO operation enables the use of up to 2N antennae in communicationwith another similarly equipped wireless system. It should be noted thatextended MIMO systems can communicate with other wireless systems evenif the systems do not have the same number of antennae, but some of theantennae of one of the stations might not be utilized, reducing optimalperformance.

CSI from any of the communication links described herein can beextracted independent of changes related to channel state parameters andused for spatial diagnosis services of the network such as motiondetection, proximity detection, and localization which can be utilizedin, for example, WLAN diagnosis, home security, health care monitoring,smart home utility control, elder care, and the like.

The following examples pertain to further embodiments.

Example 1 includes a method that includes receiving, from a wirelesssniffer, sniffer data for a window of time, the sniffer data includingwireless signal data, obtaining corresponding access point data from anaccess point in a wireless network for at least part of the window oftime for which the sniffer data is received, and analyzing the snifferdata and the corresponding access point data to assess performance ofthe wireless network.

In Example 2, the subject matter of Example 1 further includingtransmitting a message to the access point to cause the access point tochange a setting in the access point based on the analysis of thesniffer data and the corresponding access point data.

In Example 3, the subject matter of any one of Examples 1-2, where themessage to cause the access point to change the setting causes theaccess point to perform at least one of increasing broadcast power,decreasing broadcast power, changing a channel or frequency on which theaccess point broadcasts, changing channel bandwidth, toggling betweenmulti-user, multiple-input, multiple-output (MU-MIMO) and single-user(SU)-MIMO, switching on or off transmission beam-forming to a clientdevice, changing a receiving sensitivity, changing Aggregated MACProtocol Data Unit (AMPDU)/Aggregated MAC Service Data Unit (AMSDU)aggregation sizes, or power-cycling the access point.

In Example 4, the subject matter of any one of Examples 1-3 furtherincluding transmitting a message to the wireless sniffer to cause thewireless sniffer to change a mode of operation based on the analysis ofthe sniffer data and the corresponding access point data.

In Example 5, the subject matter of any one of Examples 1-4, where themessage to cause the wireless sniffer to change the mode of operationcauses the wireless sniffer to perform one of changing a channel orfrequency on which the wireless sniffer collects data, changing aduration during which the wireless sniffer collects data, or imposing afilter on operation of the wireless sniffer.

In Example 6, the subject matter of any one of Examples 1-5 furtherincluding receiving a notification of an error event at a premise withthe wireless network, and sending a trigger to the wireless sniffer inresponse to the receiving the notification of the error event, thetrigger causing the wireless sniffer to report wireless signal data.

In Example 7, the subject matter of any one of Examples 1-6, furtherincluding detecting an error event based on data from at least one ofthe access point, the wireless sniffer, or a station utilizing thewireless network, and sending a trigger to the wireless sniffer inresponse to detecting the error event, the trigger causing the wirelesssniffer to report wireless signal data.

In Example 8, the subject matter of any one of Examples 1-7, where theerror event is detected based on data from one or more access points.The method further includes receiving the data from the one or moreaccess points within the wireless network. Each of the access pointsinclude association messages, dissociation messages, or combinationsthereof, within a threshold time.

In Example 9, the subject matter of any one of Examples 1-8 furtherincluding transmitting a message to a station utilizing the wirelessnetwork to cause the station to change a setting in the station based onthe analysis of the sniffer data and the corresponding access pointdata.

In Example 10, the subject matter of any one of Examples 1-9, where themessage to cause the station to change the setting in the station causesthe station to perform at least one of suppressing a power-savingfeature, changing settings of a wireless network card or chip, disablingand reenabling the wireless network card or chip, or power-cycling thestation.

In Example 11, the subject matter of any one of Examples 1-10, where thewireless sniffer is configured to continuously obtain wireless signaldata regardless of whether or not a trigger is sent to the wirelesssniffer.

In Example 12, the subject matter of any one of Examples 1-11, where thewireless sniffer is configured to periodically send the obtained dataregardless of whether or not the trigger is sent to the wirelesssniffer.

In Example 13, the subject matter of any one of Examples 1-12 furtherincluding debugging an issue with the performance of the wirelessnetwork based on the analysis of the sniffer data and the correspondingaccess point data.

In Example 14, the subject matter of any one of Examples 1-13, where thedebugging includes a series of scripts with iterative operationsinformed by the analysis of the sniffer data and the correspondingaccess point data. The method further includes transmitting a message tochange a mode of operation to one of the access point, the wirelesssniffer, or a station utilizing the wireless network.

Example 15 includes one or more non-transitory computer-readable mediacontaining instructions that, in response to being executed by one ormore processors, cause a system to perform operations includingreceiving, from a wireless sniffer, sniffer data for a window of time,the sniffer data including wireless signal data, obtaining correspondingaccess point data from an access point in a wireless network for atleast part of the window of time for which the sniffer data is received,and analyzing the sniffer data and the corresponding access point datato assess performance of the wireless network.

In Example 16, the subject matter of Example 15, where the operationsfurther include receiving a notification of an error event at a premisewith the wireless network, and sending a trigger to the wireless snifferin response to the receiving the notification of the error event, thetrigger causing the wireless sniffer to report wireless signal data.

In Example 17, the subject matter of any one of Examples 15-16, wherethe operations further include detecting an error event based on datafrom at least one of the access point, the wireless sniffer, or astation utilizing the wireless network, and sending a trigger to thewireless sniffer in response to detecting the error event, the triggercausing the wireless sniffer to report wireless signal data.

Example 18 is a system that includes one or more processors, and one ormore non-transitory computer-readable media containing instructionsthat, in response to being executed by one or more processors, cause thesystem to perform operations that includes receiving, from a wirelesssniffer, sniffer data for a window of time, the sniffer data includingwireless signal data, obtaining corresponding access point data from anaccess point in a wireless network for at least part of the window oftime for which the sniffer data is received, and analyzing the snifferdata and the corresponding access point data to assess performance ofthe wireless network.

In Example 19, the subject matter of Example 18, where the operationsfurther include receiving a notification of an error event at a premisewith the wireless network, and sending a trigger to the wireless snifferin response to the receiving the notification of the error event, thetrigger causing the wireless sniffer to report wireless signal data.

In Example 20, the subject matter of any one of Examples 18-19, wherethe operations further include detecting an error event based on datafrom at least one of the access point, the wireless sniffer, or astation utilizing the wireless network, and sending a trigger to thewireless sniffer in response to detecting the error event, the triggercausing the wireless sniffer to report wireless signal data.

Some portions of the detailed description are presented in terms ofalgorithms and symbolic representations of operations within a computer.These algorithmic descriptions and symbolic representations are themeans used by those skilled in the data processing arts to convey theessence of their innovations to others skilled in the art. An algorithmis a series of defined operations leading to a desired end state orresult. In example implementations, the operations carried out requirephysical manipulations of tangible quantities for achieving a tangibleresult.

Unless specifically stated otherwise, as apparent from the discussion,it is appreciated that throughout the description, discussions utilizingterms such as detecting, determining, analyzing, identifying, scanningor the like, can include the actions and processes of a computer systemor other information processing device that manipulates and transformsdata represented as physical (electronic) quantities within the computersystem's registers and memories into other data similarly represented asphysical quantities within the computer system's memories or registersor other information storage, transmission or display devices.

Example implementations may also relate to an apparatus for performingthe operations herein. This apparatus may be specially constructed forthe required purposes, or it may include one or more general-purposecomputers selectively activated or reconfigured by one or more computerprograms. Such computer programs may be stored in a computer readablemedium, such as a computer-readable storage medium or acomputer-readable signal medium.

Unless specific arrangements described herein are mutually exclusivewith one another, the various implementations described herein can becombined to enhance system functionality and/or to produce complementaryfunctions. Such combinations will be readily appreciated by thoseskilled in the art given the totality of the foregoing description.Likewise, aspects of the implementations may be implemented instandalone arrangements where more limited and thus specific componentfunctionality is provided within each of the interconnected—andtherefore interacting—system components albeit that, in sum, theytogether support, realize and produce the described real-worldeffect(s). Indeed, it will be understood that unless features in theparticular implementations are expressly identified as incompatible withone another or the surrounding context implies that they are mutuallyexclusive and not readily combinable in a complementary and/orsupportive sense, the totality of this disclosure contemplates andenvisions that specific features of those complementary implementationscan be selectively combined to provide one or more comprehensive, butslightly different, technical solutions. It will, therefore, beappreciated that the above description has been given by way of exampleonly and that modification in detail may be made within the scope of thepresent invention.

Computer-executable instructions may include, for example, instructionsand data which cause a general-purpose computer, special-purposecomputer, or special-purpose processing device (e.g., one or moreprocessors) to perform or control performance of a certain function orgroup of functions. Although the subject matter has been described inlanguage specific to structural features and/or methodological acts, itis to be understood that the subject matter defined in the appendedclaims is not necessarily limited to the specific features or actsdescribed above. Rather, the specific features and acts described aboveare disclosed as example forms of implementing the claims.

As used herein, the terms “module” or “component” may refer to specifichardware implementations configured to perform the operations of themodule or component and/or software objects or software routines thatmay be stored on and/or executed by general-purpose hardware (e.g.,computer-readable media, processing devices, etc.) of the computingsystem. In some implementations, the different components, modules,engines, and services described herein may be implemented as objects orprocesses that execute on the computing system (e.g., as separatethreads). While some of the system and methods described herein aregenerally described as being implemented in software (stored on and/orexecuted by general-purpose hardware), specific hardware implementationsor a combination of software and specific hardware implementations arealso possible and contemplated. In this description, a “computingentity” may be any computing system as previously defined herein, or anymodule or combination of modulates running on a computing system.

A phrase such as “an aspect” does not imply that such aspect isessential to the subject technology or that such aspect applies to allconfigurations of the subject technology. A disclosure relating to anaspect may apply to all configurations, or one or more configurations.An aspect may provide one or more examples of the disclosure. A phrasesuch as “an aspect” may refer to one or more aspects and vice versa. Aphrase such as “an embodiment” or “an implementation” does not implythat such embodiment or implementation is essential to the subjecttechnology or that such embodiment or implementation applies to allconfigurations of the subject technology. A disclosure relating to anembodiment or implementation may apply to all embodiments orimplementations, or one or more embodiments or implementations. Anembodiment or implementation may provide one or more examples of thedisclosure. A phrase such as “an embodiment” or “an implementation” mayrefer to one or more embodiments or implementations and vice versa. Aphrase such as “a configuration” does not imply that such configurationis essential to the subject technology or that such configurationapplies to all configurations of the subject technology. A disclosurerelating to a configuration may apply to all configurations, or one ormore configurations. A configuration may provide one or more examples ofthe disclosure. A phrase such as “a configuration” may refer to one ormore configurations and vice versa.

A reference to an element in the singular is not intended to mean “oneand only one” unless specifically stated, but rather “one or more.”Pronouns in the masculine (e.g., his) include the feminine and neutergender (e.g., her and its) and vice versa. The term “some” refers to oneor more. Moreover, nothing disclosed herein is intended to be dedicatedto the public regardless of whether such disclosure is explicitlyrecited in the above description.

The present disclosure is not to be limited in terms of the particularimplementations described herein, which are intended as illustrations ofvarious aspects. Many modifications and variations can be made withoutdeparting from its spirit and scope. Functionally equivalent methods andapparatuses within the scope of the disclosure, in addition to thoseenumerated herein, are possible from the foregoing descriptions. Suchmodifications and variations are intended to fall within the scope ofthis disclosure. Also, the terminology used herein is for the purpose ofdescribing particular implementations only, and is not intended to belimiting.

With respect to the use of substantially any plural and/or singularterms herein, those having skill in the art can translate from theplural to the singular and/or from the singular to the plural as isappropriate to the context and/or application. The varioussingular/plural permutations may be expressly set forth herein for sakeof clarity.

In general, terms used herein, and especially in the appended claims(e.g., bodies of the appended claims) are generally intended as “open”terms (e.g., the term “including” should be interpreted as “includingbut not limited to,” the term “having” should be interpreted as “havingat least,” the term “includes” should be interpreted as “includes but isnot limited to,” etc.). It will be further understood by those withinthe art that if a specific number of an introduced claim recitation isintended, such an intent will be explicitly recited in the claim, and inthe absence of such recitation, no such intent is present. For example,as an aid to understanding, the following appended claims may containusage of the introductory phrases “at least one” and “one or more” tointroduce claim recitations. However, the use of such phrases should notbe construed to imply that the introduction of a claim recitation by theindefinite articles “a” or “an” limits any particular claim containingsuch introduced claim recitation to implementations containing only onesuch recitation, even when the same claim includes the introductoryphrases “one or more” or “at least one” and indefinite articles such as“a” or “an” (e.g., “a” and/or “an” should be interpreted to mean “atleast one” or “one or more”); the same holds true for the use ofdefinite articles used to introduce claim recitations. In addition, evenif a specific number of an introduced claim recitation is explicitlyrecited, those skilled in the art will recognize that such recitationshould be interpreted to mean at least the recited number (e.g., thebare recitation of “two recitations,” without other modifiers, means atleast two recitations, or two or more recitations). Furthermore, inthose instances where a convention analogous to “at least one of A, B,and C, etc.” is used, in general, such a construction is intended in thesense one having skill in the art would understand the convention (e.g.,“a system having at least one of A, B, and C” would include but not belimited to systems that include A alone, B alone, C alone, A and Btogether, A and C together, B and C together, and/or A, B, and Ctogether, etc.). In those instances where a convention analogous to “atleast one of A, B, or C, etc.” is used, in general, such a constructionis intended in the sense one having skill in the art would understandthe convention (e.g., “a system having at least one of A, B, or C” wouldinclude but not be limited to systems that include A alone, B alone, Calone, A and B together, A and C together, B and C together, and/or A,B, and C together, etc.). It will be further understood by those withinthe art that virtually any disjunctive word and/or phrase presenting twoor more alternative terms, whether in the description, claims, ordrawings, should be understood to contemplate the possibilities ofincluding one of the terms, either of the terms, or both terms. Forexample, the phrase “A or B” will be understood to include thepossibilities of “A” or “B” or “A and B.”

In addition, where features or aspects of the disclosure are describedin terms of Markush groups, those skilled in the art will recognize thatthe disclosure is also thereby described in terms of any individualmember or subgroup of members of the Markush group.

For any and all purposes, such as in terms of providing a writtendescription, all ranges disclosed herein also encompass any and allpossible sub ranges and combinations of sub ranges thereof. Any listedrange can be easily recognized as sufficiently describing and enablingthe same range being broken down into at least equal halves, thirds,quarters, fifths, tenths, and/or others. As a non-limiting example, eachrange discussed herein can be readily broken down into a lower third,middle third and upper third, etc. All language such as “up to,” “atleast,” and the like include the number recited and refer to rangeswhich can be subsequently broken down into sub ranges as discussedabove. Finally, a range includes each individual member. Thus, forexample, a group having 1-3 cells refers to groups having 1, 2, or 3cells. Similarly, a group having 1-5 cells refers to groups having 1, 2,3, 4, or 5 cells, and so forth.

From the foregoing, various implementations of the present disclosurehave been described herein for purposes of illustration, and variousmodifications may be made without departing from the scope and spirit ofthe present disclosure. Accordingly, the various implementationsdisclosed herein are not intended to be limiting.

What is claimed is:
 1. A method comprising: receiving, from a wirelesssniffer, sniffer data for a window of time, the sniffer data includingwireless signal data; obtaining corresponding access point data from anaccess point in a wireless network for at least part of the window oftime for which the sniffer data is received; analyzing the sniffer dataand the corresponding access point data to assess performance of thewireless network; transmitting a message to the wireless sniffer tocause the wireless sniffer to change a mode of operation, wherein themessage to cause the wireless sniffer to change the mode of operationcauses the wireless sniffer to change a channel or frequency on whichthe wireless sniffer collects the access point data.
 2. The method ofclaim 1, further comprising transmitting a message to the access pointto cause the access point to change a setting in the access point basedon the analysis of the sniffer data and the corresponding access pointdata.
 3. The method of claim 2, wherein the message to cause the accesspoint to change the setting causes the access point to perform at leastone of increasing broadcast power, decreasing broadcast power, changinga channel or frequency on which the access point broadcasts, changingchannel bandwidth, toggling between multi-user, multiple-input,multiple-output (MU-MIMO) and single-user (SU)-MIMO, switching on or offtransmission beam-forming to a client device, changing a receivingsensitivity, changing Aggregated MAC Protocol Data Unit(AMPDU)/Aggregated MAC Service Data Unit (AMSDU) aggregation sizes, orpower-cycling the access point.
 4. The method of claim 1, wherein themessage to the wireless sniffer to cause the wireless sniffer to changea mode of operation is determined based on the analysis of the snifferdata and the corresponding access point data.
 5. The method of claim 4,wherein the message to cause the wireless sniffer to change the mode ofoperation causes the wireless sniffer to perform one of changing achannel or frequency on which the wireless sniffer collects the wirelesssignal data, changing a duration during which the wireless sniffercollects data, or imposing a filter on operation of the wirelesssniffer.
 6. The method of claim 1, further comprising: receiving anotification of an error event at a premise with the wireless network;and sending a trigger to the wireless sniffer in response to thereceiving the notification of the error event, the trigger causing thewireless sniffer to report wireless signal data.
 7. The method of claim1, further comprising: detecting an error event based on data from atleast one of the access point, the wireless sniffer, or a stationutilizing the wireless network; and sending a trigger to the wirelesssniffer in response to detecting the error event, the trigger causingthe wireless sniffer to report wireless signal data.
 8. The method ofclaim 7, wherein the error event is detected based on data from aplurality of access points, the method further comprising receiving thedata from the plurality of access points within the wireless network,each of the plurality of access points including a plurality ofassociation messages, dissociation messages, or combinations thereof,within a threshold time.
 9. The method of claim 1, further comprisingtransmitting a message to a station utilizing the wireless network tocause the station to change a setting in the station based on theanalysis of the sniffer data and the corresponding access point data.10. The method of claim 9, wherein the message to cause the station tochange the setting in the station causes the station to perform at leastone of suppressing a power-saving feature, changing settings of awireless network card or chip, disabling and reenabling the wirelessnetwork card or chip, or power-cycling the station.
 11. The method ofclaim 1, wherein the wireless sniffer is configured to continuouslyobtain wireless signal data regardless of whether or not a trigger issent to the wireless sniffer.
 12. The method of claim 11, wherein thewireless sniffer is configured to periodically send the obtained dataregardless of whether or not the trigger is sent to the wirelesssniffer.
 13. The method of claim 1, further comprising debugging anissue with the performance of the wireless network based on the analysisof the sniffer data and the corresponding access point data.
 14. Themethod of claim 13, wherein the debugging includes a series of scriptswith iterative operations informed by the analysis of the sniffer dataand the corresponding access point data, the method further comprisingtransmitting a message to change a mode of operation to one of theaccess point, the wireless sniffer, or a station utilizing the wirelessnetwork.
 15. One or more non-transitory computer-readable mediacontaining instructions that, in response to being executed by one ormore processors, cause a system to perform operations comprising:receiving, from a wireless sniffer, sniffer data for a window of time,the sniffer data including wireless signal data; obtaining correspondingaccess point data from an access point in a wireless network for atleast part of the window of time for which the sniffer data is received;analyzing the sniffer data and the corresponding access point data toassess performance of the wireless network; transmitting a message tothe wireless sniffer to cause the wireless sniffer to change a mode ofoperation, wherein the message to cause the wireless sniffer to changethe mode of operation causes the wireless sniffer to change a channel orfrequency on which the wireless sniffer collects the access point data.16. The computer-readable media of claim 15, wherein the operationsfurther comprise: receiving a notification of an error event at apremise with the wireless network; and sending a trigger to the wirelesssniffer in response to the receiving the notification of the errorevent, the trigger causing the wireless sniffer to report wirelesssignal data.
 17. The computer-readable media of claim 15, wherein theoperations further comprise: detecting an error event based on data fromat least one of the access point, the wireless sniffer, or a stationutilizing the wireless network; and sending a trigger to the wirelesssniffer in response to detecting the error event, the trigger causingthe wireless sniffer to report wireless signal data.
 18. A systemcomprising: one or more processors; and one or more non-transitorycomputer-readable media containing instructions that, in response tobeing executed by one or more processors, cause the system to performoperations comprising: receive, from a wireless sniffer, sniffer datafor a window of time, the sniffer data including wireless signal data;obtain corresponding access point data from an access point in awireless network for at least part of the window of time for which thesniffer data is received; analyze the sniffer data and the correspondingaccess point data to assess performance of the wireless network;transmit a message to the wireless sniffer to cause the wireless snifferto change a mode of operation, wherein the message to cause the wirelesssniffer to change the mode of operation causes the wireless sniffer tochange a channel or frequency on which the wireless sniffer collects theaccess point data.
 19. The system of claim 18, wherein the operationsfurther comprise: receive a notification of an error event at a premisewith the wireless network; and send a trigger to the wireless sniffer inresponse to the receiving the notification of the error event, thetrigger causing the wireless sniffer to report wireless signal data. 20.The system of claim 18, wherein the operations further comprise: detectan error event based on data from at least one of the access point, thewireless sniffer, or a station utilizing the wireless network; and senda trigger to the wireless sniffer in response to detecting the errorevent, the trigger causing the wireless sniffer to report wirelesssignal data.